PRIVACY POLICY - WEBSITE

WHY THIS INFORMATION?

Pursuant to Regulation (EU) 2016/679 (hereinafter referred to as the "GDPR"), this page describes how personal data are processed. This privacy notice is provided pursuant to Articles 13 and 14 of the GDPR. This notice does not apply to third-party websites that may be accessed through links on this website, for which no responsibility is assumed.

PERSONAL DATA THAT MAY BE PROCESSED

• Browsing data The computer systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is inherent in the use of Internet communication protocols. This category of data includes the IP addresses or domain names of the computers and devices used by visitors, the URI/URL (Uniform Resource Identifier/Locator) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response provided by the server (successful, error, etc.), and other parameters relating to the user's operating system and computing environment.
• Data provided by the user The optional, explicit and voluntary sending of messages to the Data Controller's contact addresses, private messages sent by users to official social media profiles/pages, as well as the completion and submission of forms on the Data Controller's websites, entail the collection of the sender's contact details, which are necessary in order to respond, and any personal data included in the communications.
• Personal data Any information relating to an identified or identifiable natural person (the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Recitals 26, 27 and 30 of the GDPR).
• Data relating to contracting parties/users.

COOKIES AND OTHER TRACKING SYSTEMS. WHAT ARE THEY? WHAT ARE THEY USED FOR?

COOKIES

Cookies are text files that websites visited by users send to their devices and that are sent back to those websites on subsequent visits. For cookies and other tracking systems, please refer to the cookie policy in the website footer and at the

following link. For non-essential cookies and equivalent tracking technologies that require consent, processing is based on consent to the processing of personal data (Article 6(1)(a) and Recitals 42 and 43 of the GDPR). Consent is given through the banner and the cookie policy in the website footer.

TRACKING PIXELS IN EMAILS

Tools used to track or collect information about users' behaviour and how they use services, particularly in the online environment. Tracking pixels in email messages are images, often transparent and extremely small—typically just one pixel—that are not directly embedded in the email itself but are hosted on remote servers. As a rule, whenever the recipient opens an email, whether for the first time or on a subsequent occasion, HTML code included in the message automatically triggers a request to the sender's server. In response to this request, the image is downloaded by the recipient's email client (dedicated software or a browser) and stored in the memory of the data subject's device so that it can be displayed in the body of the email. To compare and, where appropriate, improve the results of automated communications, the Data Controller uses reporting systems (tracking pixels). Through tracking pixels, the Data Controller may obtain, for example: the number of readers, opens, unique clickers and clicks; the devices and operating systems used to read the communication; details of individual users' activity; and details of emails sent, delivered, undelivered and forwarded. All this data is used to compare and, where appropriate, improve the results of communications. Processing is based on consent to the processing of personal data (Article 6(1)(a) and Recitals 42 and 43 of the GDPR).

Information on the processing of personal data through social media platforms

With regard to the processing of personal data carried out by the operators of the social media platforms used by the Data Controller, please refer to the information provided by those operators in their respective privacy policies. The Data Controller processes personal data provided by users through its dedicated social media pages in order to manage interactions with users (comments, public posts, etc.) and in compliance with applicable legislation.

WHO IS THE DATA CONTROLLER? HOW CAN THEY BE CONTACTED?

The DATA CONTROLLER is BOFFI|DE PADOVA SPA, with its registered office at Via Oberdan, 70 - 20823 Lentate sul Seveso (MB), Italy, represented by its legal representative for the time being. The Data Controller's contact email address is privacy@boffi.com.

HAS A DATA PROTECTION OFFICER BEEN APPOINTED? WHAT ARE THEIR CONTACT DETAILS?

The DATA PROTECTION OFFICER (DPO) has been designated pursuant to Articles 37 to 39 of Regulation (EU) 2016/679. The DPO's contact email address is dpo.boffi@dpoprofessionalservice.it.

PURPOSES OF PROCESSING, LEGAL BASIS, DATA RETENTION PERIOD, NATURE OF DATA PROVISION

PURPOSES OF PROCESSING Browsing this website and using its web services. Data is also processed for the purposes of:\

• obtaining statistical information on the use of services (most frequently visited pages, number of visitors by time of day or by day, geographical areas of origin, etc.)
• monitoring the proper functioning of the services provided
• establishing liability in the event of suspected cybercrimes against the website

LEGAL BASIS

Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data, taking into account the reasonable expectations of the data subject and the activities strictly necessary for the website to function and for browsing (Article 6(1)(f) and Recital 47 of the GDPR).

DATA RETENTION PERIOD

Browsing data is retained for the duration of the browsing session. In any event, such data is not retained for more than seven days (except where necessary for the investigation of offences by judicial authorities).

NATURE OF DATA PROVISION

Providing the data is necessary in order to browse this website.

In addition to browsing, personal data will be processed for the following purposes:

A.1) CONTACTS

PURPOSES OF PROCESSING Sending contact requests and requests for information.

LEGAL BASIS

Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract. Article 6(1)(b) of the GDPR.

DATA RETENTION PERIOD

A maximum of 2 years from the collection of the data. At the end of the retention period, personal data will be anonymised.

NATURE OF DATA PROVISION

Providing the data is necessary. Failure to provide the required data will make it impossible to be contacted and receive information.

A.2) SOURCE OF DATA

For this purpose, data may come from another source (e.g. EDILPORTALE.com SpA through the “archiproducts” website).

A.3) RESTRICTED AREA

PURPOSES OF PROCESSING

To register and manage the account (including any account verification and credential recovery) in order to access the restricted areas of the website using authentication credentials and to use account-related features.

Account-related features include downloading project models. If you download a project, you will be contacted for pre-contractual purposes relating to the service.

LEGAL BASIS

Processing is necessary for the performance of a contract/service to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract (Recital 44 and Article 6(1)(b) of the GDPR).

DATA RETENTION PERIOD

A maximum of 12 months from the deactivation of the credentials, or until the termination of the contract/service and for the technical time necessary to disable the credentials. At the end of the retention period, personal data will be anonymised.

NATURE OF DATA PROVISION

Providing the data is necessary. Failure to provide the data will make it impossible to register for or access the restricted area.

SOURCE OF DATA

For this purpose, data may come from another source (e.g. EDILPORTALE.com SpA through the “archiproducts” website).

B) DIRECT MARKETING

PURPOSES OF PROCESSING

For the sending of advertising or direct sales materials, the performance of market research or satisfaction surveys, or commercial communications and newsletters through automated means (email, including tracking pixels, and through social networks and sponsored content) and traditional means (postal mail and telephone calls made by an operator).

LEGAL BASIS

Processing is based on consent to the processing of personal data (Recitals 42 and 43 and Article 6(1)(a) of the GDPR).

DATA RETENTION PERIOD

Until consent is withdrawn (or until opting out of email communications only).

NATURE OF DATA PROVISION

Providing the data is optional. Failure to provide the required data will make it impossible to receive direct marketing communications.

C) NON-AUTOMATED PROFILING

PURPOSES OF PROCESSING

Personal data will be entered into databases/web platforms for analysis, in order to divide data subjects into groups with similar specific characteristics, using assessments, to improve the management of services and to send targeted promotional communications.

LEGAL BASIS

Processing is based on consent to the processing of personal data (Recitals 42 and 43 and Article 6(1)(a) of the GDPR).

DATA RETENTION PERIOD

A maximum of 24 months from the collection of the data, unless consent is withdrawn. At the end of the retention period, personal data will be anonymised.

NATURE OF DATA PROVISION

Providing the data is optional. Failure to provide the required data will make it impossible to carry out analyses and send targeted communications.

D) RIGHTS OF THE DATA SUBJECT\

PURPOSES OF PROCESSING

Managing requests from data subjects, pursuant to Articles 15 et seq. of the GDPR**.**

LEGAL BASIS

Processing is necessary to comply with a legal obligation to which the Data Controller is subject (Recital 45), following your request to exercise your rights. Article 6(1)(c) of the GDPR.

DATA RETENTION PERIOD

5 years from the closure of the request, unless litigation is pending.

NATURE OF DATA PROVISION

Providing personal data is mandatory, as it is essential in order to comply with legal obligations.

TO WHOM WILL PERSONAL DATA BE DISCLOSED? RECIPIENTS OF THE DATA

Personal data will be disclosed to entities that process the data as independent Data Controllers or Data Processors (Article 28 of the GDPR), and processed by natural persons (Article 29 of the GDPR) acting under the authority of the Data Controller and Data Processors, on the basis of specific instructions regarding the purposes and methods of processing. Data will be disclosed to recipients belonging to the following categories:\

• Entities providing website and communications network services, including email, hosting and website management;
• Entities responsible for managing information systems and telecommunications networks (including email, web and cloud platforms, and CRM);
• Social networking platforms;
• Entities managing marketing activities, subject to consent;
• Competent authorities, upon request, for compliance with legal obligations and/or provisions issued by public bodies.

The list of Data Processors pursuant to Article 28 is available by writing to privacy@boffi.com or to the other contact details indicated above.

WILL DATA BE TRANSFERRED TO COUNTRIES OUTSIDE THE EEA?

Personal data may be transferred to countries outside the European Economic Area (EEA) for purposes related to those described above. In particular, in connection with interactions on social networks, transfers of personal data outside the EEA will be governed by the terms and conditions and privacy policies of the relevant social networks. Data will be transferred to entities participating in the Data Privacy Framework (DPF) Program or under the European Commission's Standard Contractual Clauses (SCCs). For information on the safeguards relating to transfers of data outside the EEA, please write to privacy@boffi.com.

IS THERE ANY AUTOMATED PROCESSING?

Personal data will be processed using traditional manual, electronic and automated methods. No fully automated decision-making processes are carried out. With regard to any profiling conducted with the data subject's express consent, as indicated under the purposes of processing, it will involve an operator who will develop the data subject's profile and analyse their habits and purchasing choices, with the aim of improving the Data Controller's commercial offering and services (non-automated profiling).

WHAT ARE YOUR RIGHTS? HOW CAN YOU EXERCISE THEM?

Data subjects may exercise their rights under Articles 15 et seq. of the GDPR by contacting the DPO at dpo.boffi@dpoprofessionalservice.it or the Data Controller at privacy@boffi.com.

The Data Controller guarantees data subjects the ability to request, at any time, access to their personal data (Article 15), rectification (Article 16), erasure (Article 17) and restriction of processing (Article 18). The Data Controller shall notify (Article 19) each recipient to whom personal data has been disclosed of any rectification, erasure or restriction of processing carried out. The Data Controller shall inform data subjects of these recipients if they request this information. The Data Controller guarantees the right to data portability (Article 20) and, in the event of a request pursuant to Article 20, shall provide data subjects with the data in a structured, commonly used and machine-readable format. Data subjects have the right to object (Article 21), at any time, to the processing of data based on the Data Controller's legitimate interests by sending an email to dpo.boffi@dpoprofessionalservice.it with the subject line “opposizione” (objection). In the event that the right to object to processing based on legitimate interests is exercised. Data subjects also have the right to withdraw consent previously given, without affecting the lawfulness of processing based on consent before its withdrawal. To stop receiving automated direct marketing communications (email or communications through social networks and sponsored content), simply write to dpo.boffi@dpoprofessionalservice.it with the subject line “cancellazione da automatizzato” (unsubscribe from automated communications), or use our automated unsubscribe systems available for email only (opt-out). To stop receiving traditional direct marketing communications (telephone calls from an operator and postal mail), simply write to dpo.boffi@dpoprofessionalservice.it with the subject line “cancellazione da tradizionale” (unsubscribe from traditional communications). To stop receiving all marketing communications, write to dpo.boffi@dpoprofessionalservice.it with the subject line “cancellazione marketing” (unsubscribe from marketing). To withdraw consent to non-automated profiling, simply write at any time to dpo.boffi@dpoprofessionalservice.it with the subject line “no profilazione” (no profiling). Consent preferences for tracking pixels are managed through the footer of email communications (preferences). If data subjects believe that the processing of their personal data by the Data Controller infringes Regulation (EU) 2016/679, they may lodge a complaint with the national supervisory authority, particularly in the Member State of their habitual residence, place of work or place of the alleged infringement (Italian Data Protection Authority: https://www.garanteprivacy.it/), or seek a judicial remedy before the competent courts.

CHANGES TO THIS PRIVACY NOTICE

The Data Controller may change, amend, add or remove any part of this Privacy Notice. To facilitate the identification of any changes, the notice will indicate the date on which it was last updated.

Last updated: 11 August 2026

BOFFI|DE PADOVA SPA